CVE-2026-41526

Name	CVE-2026-41526
Description	In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1135178, 1135179

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
kcoreaddons (PTS)	bullseye	5.78.0-4	vulnerable
	bookworm	5.103.0-1	vulnerable
	trixie	5.116.0-1	vulnerable
	forky, sid	5.116.0-4	fixed
kf6-kcoreaddons (PTS)	trixie	6.13.0-1	vulnerable
	forky, sid	6.26.0-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
kcoreaddons	source	(unstable)	5.116.0-2			1135179
kf6-kcoreaddons	source	(unstable)	6.26.0-1			1135178

Notes

[trixie] - kcoreaddons <no-dsa> (Minor issue)
[trixie] - kf6-kcoreaddons <no-dsa> (Minor issue)
https://kde.org/info/security/advisory-20260427-1.txt
Fixed by: https://invent.kde.org/frameworks/kcoreaddons/-/commit/447250fb061d6a866eeef9ae3c21b627244b198a (v6.25.0)